I've been sticking the IPs into IMAIL's control access list as fast as they have been coming in. Declude reports them and I'm popping them in there and I'm not sure I'm ever going to remove them.
Under local host > SMTP > second tab SMTP security > Control access button You must stop and restart SMTP for the changes to take effect Marc -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Dan Spangenberg Sent: Saturday, August 30, 2003 1:51 AM To: [EMAIL PROTECTED] Subject: RE: [Declude.Virus] SoBig Where are you denying those IP addresses....at your router I assume? I don't have control over that...is ther anyplace else to enter an IP address to be denied? Imail? Delcude? Dan -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of serge Sent: Friday, August 29, 2003 8:57 PM To: [EMAIL PROTECTED] Subject: Re: [Declude.Virus] SoBig thanks scott i was able to select a dozen of adresses and this is making a big difference !SoBig senders deny tcp host 200.93.136.5 any eq smtp deny tcp host 81.192.2.130 any eq smtp deny tcp host 80.11.225.195 any eq smtp deny tcp host 80.11.225.123 any eq smtp deny tcp host 80.14.187.188 any eq smtp deny tcp host 193.253.189.90 any eq smtp deny tcp host 217.128.120.96 any eq smtp deny tcp host 194.167.144.29 any eq smtp deny tcp host 196.1.100.215 any eq smtp deny tcp host 212.62.54.13 any eq smtp deny tcp host 213.154.90.82 any eq smtp deny tcp host 213.154.70.180 any eq smtp deny tcp host 141.155.142.158 any eq smtp deny tcp host 217.136.255.62 any eq smtp deny tcp host 200.93.136.5 any eq smtp deny tcp host 217.136.255.62 any eq smtp deny tcp host 63.126.131.20 any eq smtp ----- Original Message ----- From: "R. Scott Perry" <[EMAIL PROTECTED]> To: <[EMAIL PROTECTED]> Sent: Saturday, August 30, 2003 1:51 AM Subject: Re: [Declude.Virus] SoBig > > >is there a utility that will go thru the log and count the numbers of > >viruses per remote (or local) ip adress? so i can block the most > >guilty adresses on my gateway ? > > You might want to go to the spool directory at a command prompt, and > type: > > find "Received:" D*.SMD > file1.txt > sort < file1.txt > file2.txt > > Then, you can open file2.txt with Notepad and scroll through it to > find the > worst offenders. If you have several weeks or more of viruses in > there, you may want to clear out the directory and only use new > incoming viruses. > > -Scott > --- > Declude JunkMail: The advanced anti-spam solution for IMail > mailservers. Declude Virus: Catches known viruses and is the leader in > mailserver vulnerability detection. Find out what you have been > missing: Ask for a free 30-day evaluation. > > --- > [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] > > --- > This E-mail came from the Declude.Virus mailing list. To unsubscribe, > just send an E-mail to [EMAIL PROTECTED], and > type "unsubscribe Declude.Virus". The archives can be found > at http://www.mail-archive.com. > --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus". The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus". The archives can be found at http://www.mail-archive.com. --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus". The archives can be found at http://www.mail-archive.com.
